CVE-2025-62518

HIGH8.1EPSS 0.02%

`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling

Published: 10/21/2025Modified: 2/4/2026
Also known as:GHSA-j5gw-2vrg-8fgxCGA-c43c-444v-mwfpRUSTSEC-2025-0110RUSTSEC-2025-0111

Description

The archive reader incorrectly handles PAX extended headers, when the ustar header incorrectly specifies zero size (`size=000000000000`), while a PAX header specifies a non-zero size, `tokio-tar::Archive` is going to read the file content as tar entry header. This can be used by a tar file to present different content to `tokio-tar` compared to other tar reader implementations. This bug is also known as `CVE-2025-62518` and `GHSA-j5gw-2vrg-8fgx`, as those crates share a common ancestor codebase. The `tokio-tar` crate is archived and no longer maintained, we recommend you switch to an alternative crate such as: - [`astral-tokio-tar`](https://crates.io/crates/astral-tokio-tar)

Affected packages (6)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References (16)